CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

UBUNTU-CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

Code injection

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

CVE-2015-3455

Squid 3.x is affected when configured with client-first SSL-bump: it does not properly validate the domain/hostname in X.509 certificates, allowing man-in-the-middle attackers to spoof SSL servers with a valid certificate. Affected versions are Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4....

CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

squid insufficient certificate validation

Insufficient check for server certificate...

[ MDVSA-2015:230 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:230 http://www.mandriva.com/en/support/security/ Package : squid Date : May 6, 2015 Affected: Business Server 2.0 Problem Description: Updated squid packages fix security vulnerability: Squid configured with...

Mandriva Linux Security Advisory : squid (MDVSA-2015:230)

Updated squid packages fix security vulnerability : Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

MGASA-2015-0191 Updated squid packages fix CVE-2015-3455

Updated squid packages fix security vulnerability: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455...

Updated squid packages fix CVE-2015-3455

Updated squid packages fix security vulnerability: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455...

squid -- client-first SSL-bump does not correctly validate X509 server certificate

Squid security advisory 2015:1 reports: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields. The bug is important because it allows remote servers to bypass client certificate validation. Some attackers may also be able to use...

squid: weak certificate validation

The flaw allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain. However, the bug is exploitable only if you have configured Squid to perform SSL...

Debian DLA-216-1 : squid security update

CVE-2014-3609: Denial of Service in Range header processing. Ignore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid. NOTE: Tenable Network Security has extracted the preceding description block directly fr...

[SECURITY] [DLA 216-1] squid security update

Package : squid Version : 2.7.STABLE9-2.1+deb6u1 CVE ID : CVE-2014-3609 CVE-2014-3609: Denial of Service in Range header processing. Ignore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid...

Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the accessibility of protected information

Multiple vulnerabilities exist in the Squid package of the SUSE Linux Enterprise operating system. Exploitation of these vulnerabilities can lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the OpenSUSE operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the squid3 package for the OpenSUSE operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

Vulnerabilities in the operating system openSUSE, which allow a malicious individual to compromise the accessibility of protected information

Multiple vulnerabilities exist in the squid package of the OpenSUSE operating system; exploiting these vulnerabilities can lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

Squid < 3.1.0.10 HTTP Header Injection Vulnerability

According to its banner, the version of Squid is 0.x, 1.x, 2.x and 3.x earlier than 3.1.0.10. Such versions are potentially affected by an HTTP Header Injection vulnerability. A remote attacker, exploiting this flaw could create a CRLF condition. CVE-2015-0881 C Tenable Network Security, Inc...

Mandriva Linux Security Advisory : squid (MDVSA-2015:103)

Updated squid packages fix security vulnerabilities : Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled CVE-2014-0128. Matthew Daley discovered that Squid 3 did not properly...